[ 73.785825][ T1161] team0 (unregistering): Port device team_slave_1 removed [ 73.798275][ T1161] team0 (unregistering): Port device team_slave_0 removed [ 73.809181][ T1161] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 73.821791][ T1161] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 73.869861][ T1161] bond0 (unregistering): Released all slaves [ 76.494958][ T1107] cfg80211: failed to load regulatory.db Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts. 2025/09/23 18:42:08 parsed 1 programs [ 83.558283][ T4522] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS [ 86.661773][ T4276] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.670128][ T4276] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.708519][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 86.710378][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 86.721361][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.744064][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 87.896053][ T4694] chnl_net:caif_netlink_parms(): no params data found [ 87.981084][ T4694] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.990208][ T4694] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.999697][ T4694] device bridge_slave_0 entered promiscuous mode [ 88.035747][ T4694] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.043902][ T4694] bridge0: port 2(bridge_slave_1) entered disabled state [ 88.052112][ T4694] device bridge_slave_1 entered promiscuous mode [ 88.077998][ T4694] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 88.090350][ T4694] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 88.135339][ T4694] team0: Port device team_slave_0 added [ 88.143254][ T4694] team0: Port device team_slave_1 added [ 88.166001][ T4694] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.173240][ T4694] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.200590][ T4694] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.234545][ T4694] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.241918][ T4694] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.268211][ T4694] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.305232][ T4694] device hsr_slave_0 entered promiscuous mode [ 88.312294][ T4694] device hsr_slave_1 entered promiscuous mode [ 88.768814][ T4694] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.780078][ T4694] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.792343][ T4694] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.818644][ T4694] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.933535][ T4694] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.948905][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 88.957037][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 88.975660][ T4694] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.994852][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 89.011983][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 89.024005][ T1161] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.031241][ T1161] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.053799][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 89.063158][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 89.073262][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 89.083407][ T1161] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.090745][ T1161] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.106084][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 89.116157][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 89.125538][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 89.136865][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 89.157637][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 89.165843][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 89.183360][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 89.193724][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 89.207726][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 89.218682][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 89.228530][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 89.241745][ T4694] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 89.396610][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 89.412566][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 89.425212][ T4694] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.475922][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 89.493314][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 89.522491][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 89.533002][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 89.544560][ T4694] device veth0_vlan entered promiscuous mode [ 89.551991][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 89.560290][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 89.576256][ T4694] device veth1_vlan entered promiscuous mode [ 89.610122][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 89.620892][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 89.642278][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 89.662069][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 89.672965][ T4694] device veth0_macvtap entered promiscuous mode [ 89.694339][ T4694] device veth1_macvtap entered promiscuous mode [ 89.725492][ T4694] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 89.752451][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 89.772878][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 89.782766][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 89.814798][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 89.826564][ T4694] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 89.843793][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 89.878052][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 89.889468][ T4694] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.911250][ T4694] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.920101][ T4694] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.929233][ T4694] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 2025/09/23 18:42:18 executed programs: 0 [ 90.676844][ T144] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.819306][ T4816] chnl_net:caif_netlink_parms(): no params data found [ 90.876675][ T4816] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.884171][ T4816] bridge0: port 1(bridge_slave_0) entered disabled state [ 90.892563][ T4816] device bridge_slave_0 entered promiscuous mode [ 90.902171][ T4816] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.909600][ T4816] bridge0: port 2(bridge_slave_1) entered disabled state [ 90.918224][ T4816] device bridge_slave_1 entered promiscuous mode [ 90.944045][ T4816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 90.955512][ T4816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.987492][ T4816] team0: Port device team_slave_0 added [ 90.996090][ T4816] team0: Port device team_slave_1 added [ 91.020032][ T4816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.027118][ T4816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.054249][ T4816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.068564][ T4816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.075866][ T4816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.106747][ T4816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.147737][ T4816] device hsr_slave_0 entered promiscuous mode [ 91.155041][ T4816] device hsr_slave_1 entered promiscuous mode [ 91.162390][ T4816] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.170208][ T4816] Cannot create hsr debugfs directory [ 92.731439][ T4320] Bluetooth: hci0: command 0x0409 tx timeout [ 92.869669][ T144] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.386214][ T144] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.427570][ T144] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 94.811345][ T4655] Bluetooth: hci0: command 0x041b tx timeout [ 95.194505][ T4816] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 95.204176][ T4816] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 95.222911][ T4816] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 95.232515][ T4816] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 95.288664][ T4816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 95.306391][ T4816] 8021q: adding VLAN 0 to HW filter on device team0 [ 95.314055][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 95.323048][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 95.346574][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 95.355512][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 95.364787][ T151] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.371911][ T151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 95.380375][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 95.390725][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 95.400178][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 95.408996][ T151] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.416177][ T151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 95.438807][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 95.449587][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 95.462204][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 95.472570][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 95.482806][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 95.493796][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 95.503508][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 95.525610][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 95.534563][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 95.546571][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 95.555138][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 95.566989][ T4816] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 95.579275][ T144] device hsr_slave_0 left promiscuous mode [ 95.586795][ T144] device hsr_slave_1 left promiscuous mode [ 95.593717][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 95.601468][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 95.609225][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 95.617208][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 95.625527][ T144] device bridge_slave_1 left promiscuous mode [ 95.632240][ T144] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.640857][ T144] device bridge_slave_0 left promiscuous mode [ 95.647193][ T144] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.658323][ T144] device veth1_macvtap left promiscuous mode [ 95.664551][ T144] device veth0_macvtap left promiscuous mode [ 95.670955][ T144] device veth1_vlan left promiscuous mode [ 95.676905][ T144] device veth0_vlan left promiscuous mode [ 95.796319][ T144] team0 (unregistering): Port device team_slave_1 removed [ 95.810563][ T144] team0 (unregistering): Port device team_slave_0 removed [ 95.823517][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 95.836655][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 95.887207][ T144] bond0 (unregistering): Released all slaves [ 96.020857][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 96.029205][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 96.041770][ T4816] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 96.058304][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 96.067442][ T4276] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 96.089274][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 96.106204][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 96.115888][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 96.123768][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 96.135227][ T4816] device veth0_vlan entered promiscuous mode [ 96.145882][ T4816] device veth1_vlan entered promiscuous mode [ 96.170131][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 96.179350][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 96.188607][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 96.199148][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 96.209239][ T4816] device veth0_macvtap entered promiscuous mode [ 96.219977][ T4816] device veth1_macvtap entered promiscuous mode [ 96.234885][ T4816] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 96.243783][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 96.252624][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 96.261854][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 96.270407][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 96.281986][ T4816] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.289511][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 96.298514][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 96.322888][ T4816] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.333468][ T4816] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.342503][ T4816] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.351585][ T4816] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.410929][ T4276] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.424966][ T4276] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.446731][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready 2025/09/23 18:42:24 executed programs: 2 [ 96.456473][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.466461][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.476212][ T1161] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 96.569416][ T5128] loop0: detected capacity change from 0 to 4096 [ 96.604250][ T5128] ntfs: (device loop0): check_mft_mirror(): $MFT and $MFTMirr (record 1) do not match. Run ntfsfix or chkdsk. [ 96.632710][ T5128] ntfs: (device loop0): load_system_files(): $MFTMirr does not match $MFT. Mounting read-only. Run ntfsfix and/or chkdsk. [ 96.662118][ T5128] ntfs: (device loop0): ntfs_read_locked_inode(): First extent of $DATA attribute has non zero lowest_vcn. [ 96.681277][ T5128] ntfs: (device loop0): ntfs_read_locked_inode(): Failed with error code -5. Marking corrupt inode 0xa as bad. Run chkdsk. [ 96.695200][ T5128] ntfs: (device loop0): load_and_init_upcase(): Failed to load $UpCase from the volume. Using default. [ 96.708577][ T5128] ntfs: volume version 3.1. [ 96.716370][ T5128] ntfs: (device loop0): ntfs_check_logfile(): Did not find any restart pages in $LogFile and it was not empty. [ 96.729234][ T5128] ntfs: (device loop0): load_system_files(): Failed to load $LogFile. Will not be able to remount read-write. Mount in Windows. [ 96.745128][ T5128] ntfs: (device loop0): ntfs_lookup_inode_by_name(): Corrupt directory. Aborting lookup. [ 96.755815][ T5128] ntfs: (device loop0): check_windows_hibernation_status(): Failed to find inode number for hiberfil.sys. [ 96.768773][ T5128] ntfs: (device loop0): load_system_files(): Failed to determine if Windows is hibernated. Will not be able to remount read-write. Run chkdsk. [ 96.807398][ T4816] ================================================================== [ 96.816379][ T4816] BUG: KASAN: slab-out-of-bounds in ntfs_readdir+0xdda/0x3550 [ 96.824307][ T4816] Read of size 1 at addr ffff888024b6c5e1 by task syz-executor/4816 [ 96.833149][ T4816] [ 96.835518][ T4816] CPU: 0 PID: 4816 Comm: syz-executor Not tainted syzkaller #0 [ 96.843192][ T4816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 96.853701][ T4816] Call Trace: [ 96.857110][ T4816] [ 96.860133][ T4816] dump_stack_lvl+0x168/0x230 [ 96.864833][ T4816] ? show_regs_print_info+0x20/0x20 [ 96.870274][ T4816] ? load_image+0x3b0/0x3b0 [ 96.874976][ T4816] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 96.880448][ T4816] print_address_description+0x60/0x2d0 [ 96.886263][ T4816] ? ntfs_readdir+0xdda/0x3550 [ 96.891132][ T4816] kasan_report+0xdf/0x130 [ 96.895686][ T4816] ? ntfs_readdir+0xdda/0x3550 [ 96.900609][ T4816] ? unmap_mft_record+0x171/0x2e0 [ 96.905825][ T4816] ntfs_readdir+0xdda/0x3550 [ 96.910564][ T4816] ? __might_sleep+0xf0/0xf0 [ 96.915159][ T4816] ? preempt_count_add+0x8d/0x190 [ 96.920360][ T4816] ? rwsem_write_trylock+0x12f/0x1b0 [ 96.925688][ T4816] ? clear_nonspinnable+0x60/0x60 [ 96.930804][ T4816] ? ntfs_unmap_page+0x200/0x200 [ 96.935767][ T4816] iterate_dir+0x218/0x560 [ 96.940280][ T4816] __se_sys_getdents64+0xe5/0x260 [ 96.945302][ T4816] ? __x64_sys_getdents64+0x80/0x80 [ 96.950524][ T4816] ? filldir+0x720/0x720 [ 96.955035][ T4816] ? vtime_user_exit+0x2dc/0x400 [ 96.959985][ T4816] ? lockdep_hardirqs_on+0x94/0x140 [ 96.965184][ T4816] do_syscall_64+0x4c/0xa0 [ 96.969683][ T4816] ? clear_bhb_loop+0x30/0x80 [ 96.974358][ T4816] ? clear_bhb_loop+0x30/0x80 [ 96.979152][ T4816] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.985168][ T4816] RIP: 0033:0x7f1d86ea1553 [ 96.989591][ T4816] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 3e f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 [ 97.009386][ T4816] RSP: 002b:00007ffdd1971778 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 97.018185][ T4816] RAX: ffffffffffffffda RBX: 000055555986b600 RCX: 00007f1d86ea1553 [ 97.026342][ T4816] RDX: 0000000000008000 RSI: 000055555986b600 RDI: 0000000000000005 [ 97.034418][ T4816] RBP: 000055555986b5d4 R08: 0000000000028a41 R09: 0000000000000000 [ 97.042485][ T4816] R10: 00007f1d87077cc0 R11: 0000000000000293 R12: ffffffffffffffa8 [ 97.050576][ T4816] R13: 0000000000000010 R14: 000055555986b5d0 R15: 00007ffdd1973a30 [ 97.058736][ T4816] [ 97.061768][ T4816] [ 97.064085][ T4816] Allocated by task 4816: [ 97.068486][ T4816] __kasan_kmalloc+0xb5/0xf0 [ 97.073165][ T4816] ntfs_readdir+0x798/0x3550 [ 97.077755][ T4816] iterate_dir+0x218/0x560 [ 97.082169][ T4816] __se_sys_getdents64+0xe5/0x260 [ 97.087188][ T4816] do_syscall_64+0x4c/0xa0 [ 97.091872][ T4816] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.097931][ T4816] [ 97.100247][ T4816] The buggy address belongs to the object at ffff888024b6c580 [ 97.100247][ T4816] which belongs to the cache kmalloc-64 of size 64 [ 97.114563][ T4816] The buggy address is located 33 bytes to the right of [ 97.114563][ T4816] 64-byte region [ffff888024b6c580, ffff888024b6c5c0) [ 97.128448][ T4816] The buggy address belongs to the page: [ 97.134274][ T4816] page:ffffea000092db00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24b6c [ 97.144533][ T4816] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 97.152286][ T4816] raw: 00fff00000000200 ffffea0000adbd40 0000000c0000000c ffff888016841640 [ 97.161154][ T4816] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 97.169753][ T4816] page dumped because: kasan: bad access detected [ 97.176348][ T4816] page_owner tracks the page as allocated [ 97.182150][ T4816] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 3562, ts 15734473038, free_ts 13669575275 [ 97.198142][ T4816] get_page_from_freelist+0x1b77/0x1c60 [ 97.203891][ T4816] __alloc_pages+0x1e1/0x470 [ 97.208586][ T4816] new_slab+0xc0/0x4b0 [ 97.212876][ T4816] ___slab_alloc+0x81e/0xdf0 [ 97.217704][ T4816] __kmalloc+0x1cd/0x330 [ 97.221937][ T4816] tomoyo_encode+0x27e/0x540 [ 97.226619][ T4816] tomoyo_realpath_from_path+0x5cd/0x610 [ 97.232298][ T4816] tomoyo_path_perm+0x1cd/0x510 [ 97.237362][ T4816] security_inode_getattr+0xcf/0x120 [ 97.242654][ T4816] vfs_getattr+0x26/0x3a0 [ 97.247008][ T4816] vfs_statx+0x149/0x4d0 [ 97.251247][ T4816] __x64_sys_newfstatat+0x12c/0x1b0 [ 97.256446][ T4816] do_syscall_64+0x4c/0xa0 [ 97.260859][ T4816] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.266752][ T4816] page last free stack trace: [ 97.271456][ T4816] free_unref_page_prepare+0x637/0x6c0 [ 97.277017][ T4816] free_unref_page+0x94/0x280 [ 97.281986][ T4816] kasan_depopulate_vmalloc_pte+0x67/0x80 [ 97.287733][ T4816] __apply_to_page_range+0x983/0xd10 [ 97.293001][ T4816] kasan_release_vmalloc+0x93/0xb0 [ 97.298185][ T4816] __purge_vmap_area_lazy+0xc6e/0x18f0 [ 97.303889][ T4816] _vm_unmap_aliases+0x410/0x4a0 [ 97.309075][ T4816] change_page_attr_set_clr+0x311/0xc10 [ 97.314962][ T4816] set_memory_nx+0xd3/0x110 [ 97.319634][ T4816] free_initmem+0x8e/0xd0 [ 97.324056][ T4816] kernel_init+0x23/0x1b0 [ 97.328451][ T4816] ret_from_fork+0x1f/0x30 [ 97.332952][ T4816] [ 97.335346][ T4816] Memory state around the buggy address: [ 97.341053][ T4816] ffff888024b6c480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 97.349529][ T4816] ffff888024b6c500: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc [ 97.358030][ T4816] >ffff888024b6c580: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 97.366601][ T4816] ^ [ 97.373788][ T4816] ffff888024b6c600: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 97.382375][ T4816] ffff888024b6c680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 97.390410][ T4816] ================================================================== [ 97.398462][ T4816] Disabling lock debugging due to kernel taint [ 97.406247][ T4641] Bluetooth: hci0: command 0x040f tx timeout [ 97.409044][ T4816] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 97.419978][ T4816] CPU: 1 PID: 4816 Comm: syz-executor Tainted: G B syzkaller #0 [ 97.430079][ T4816] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 97.441149][ T4816] Call Trace: [ 97.444535][ T4816] [ 97.447587][ T4816] dump_stack_lvl+0x168/0x230 [ 97.452603][ T4816] ? show_regs_print_info+0x20/0x20 [ 97.457811][ T4816] ? load_image+0x3b0/0x3b0 [ 97.462710][ T4816] panic+0x2c9/0x7f0 [ 97.466811][ T4816] ? bpf_jit_dump+0xd0/0xd0 [ 97.471390][ T4816] ? _raw_spin_unlock_irqrestore+0xf6/0x100 [ 97.477387][ T4816] ? _raw_spin_unlock+0x40/0x40 [ 97.482734][ T4816] ? ntfs_readdir+0xdda/0x3550 [ 97.487778][ T4816] check_panic_on_warn+0x80/0xa0 [ 97.492753][ T4816] ? ntfs_readdir+0xdda/0x3550 [ 97.497578][ T4816] end_report+0x6d/0xf0 [ 97.501925][ T4816] kasan_report+0x102/0x130 [ 97.506898][ T4816] ? ntfs_readdir+0xdda/0x3550 [ 97.512142][ T4816] ? unmap_mft_record+0x171/0x2e0 [ 97.517834][ T4816] ntfs_readdir+0xdda/0x3550 [ 97.522745][ T4816] ? __might_sleep+0xf0/0xf0 [ 97.527453][ T4816] ? preempt_count_add+0x8d/0x190 [ 97.533366][ T4816] ? rwsem_write_trylock+0x12f/0x1b0 [ 97.538879][ T4816] ? clear_nonspinnable+0x60/0x60 [ 97.544118][ T4816] ? ntfs_unmap_page+0x200/0x200 [ 97.549402][ T4816] iterate_dir+0x218/0x560 [ 97.553828][ T4816] __se_sys_getdents64+0xe5/0x260 [ 97.558856][ T4816] ? __x64_sys_getdents64+0x80/0x80 [ 97.564135][ T4816] ? filldir+0x720/0x720 [ 97.568357][ T4816] ? vtime_user_exit+0x2dc/0x400 [ 97.573376][ T4816] ? lockdep_hardirqs_on+0x94/0x140 [ 97.578552][ T4816] do_syscall_64+0x4c/0xa0 [ 97.583082][ T4816] ? clear_bhb_loop+0x30/0x80 [ 97.587751][ T4816] ? clear_bhb_loop+0x30/0x80 [ 97.592523][ T4816] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 97.598692][ T4816] RIP: 0033:0x7f1d86ea1553 [ 97.603216][ T4816] Code: c1 66 0f 1f 44 00 00 48 83 c4 08 48 89 ef 5b 5d e9 52 3e f8 ff 66 90 b8 ff ff ff 7f 48 39 c2 48 0f 47 d0 b8 d9 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 c7 c2 a8 ff ff ff f7 d8 [ 97.623674][ T4816] RSP: 002b:00007ffdd1971778 EFLAGS: 00000293 ORIG_RAX: 00000000000000d9 [ 97.632078][ T4816] RAX: ffffffffffffffda RBX: 000055555986b600 RCX: 00007f1d86ea1553 [ 97.640205][ T4816] RDX: 0000000000008000 RSI: 000055555986b600 RDI: 0000000000000005 [ 97.648170][ T4816] RBP: 000055555986b5d4 R08: 0000000000028a41 R09: 0000000000000000 [ 97.656777][ T4816] R10: 00007f1d87077cc0 R11: 0000000000000293 R12: ffffffffffffffa8 [ 97.665262][ T4816] R13: 0000000000000010 R14: 000055555986b5d0 R15: 00007ffdd1973a30 [ 97.673584][ T4816] [ 97.677262][ T4816] Kernel Offset: disabled [ 97.681629][ T4816] Rebooting in 86400 seconds..